xvclipper | 4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e.zip
Size 2.7MB
Sample260928-s714dax18m
SHA256 735c5b2a53d4b734eaf8c201c2f86fd31efb7b4dc11b683436cd2ebf16ea3311
MD5 c66ee4bb70159f2f3f1b6d9a3b63bb41
SHA1 cb5f7b1aa31d087a173db61d1abfe74f7e4e32b0
SHA512 8df5ccd5b3328dce8687bddb89460f14b2602f9747c32e763cfb801de401d8cabc07e67e67cd60d98f9f3e989b09ca8774df9615a938cce09ef21ee59e6f3f3e
SSDEEP 49152:G5jbXmHfH4z8VfFsjZo6N43n58tUdi6kOUgUK0AIAGxHvqv2LJ0jUnPFTCMh4:5/YzUKj66N43n58th6kpw0gKCv2LqjUM
TLSH
T100D5333A5E60D2F668ECB740DB6B377C53D853A7890BCC9FD88260068D7B2F59A464D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e

File Explorer

4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e.zip

.zip 2.7MB
4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e

.exe 6.6MB

4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e.zip

SHA256 735c5b2a53d4b734eaf8c201c2f86fd31efb7b4dc11b683436cd2ebf16ea3311
MD5 c66ee4bb70159f2f3f1b6d9a3b63bb41
SHA1 cb5f7b1aa31d087a173db61d1abfe74f7e4e32b0
SHA512 8df5ccd5b3328dce8687bddb89460f14b2602f9747c32e763cfb801de401d8cabc07e67e67cd60d98f9f3e989b09ca8774df9615a938cce09ef21ee59e6f3f3e
SSDEEP 49152:G5jbXmHfH4z8VfFsjZo6N43n58tUdi6kOUgUK0AIAGxHvqv2LJ0jUnPFTCMh4:5/YzUKj66N43n58th6kpw0gKCv2LqjUM
TLSH
T100D5333A5E60D2F668ECB740DB6B377C53D853A7890BCC9FD88260068D7B2F59A464D0
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e
MD5 305e6573de2ee6f433bfab0159dd1acd
SHA1 724a09cd793dd5f490e592e8e8bea80636601410
SHA512 cea447c2feb564cb5e14f5080523c0d1f32a9b2c86e2685846a8230eacfa1d52cd78b36bb7ed4d30b26ada3f6d1722d18d841259d14e926a8f0e5663869a8d49
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8P:T6BJUoROZfIA8Xf8xumvBh8huTEEm50
TLSH
T17F665C53EC6555E8C5AEE1718A7392537BB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e.zip

4d2a37f729886eba5b1439d4507975e7e4cc5f1a312f5b1e99af1f5e38e4595e

kernel32

generic